Resource Exhaustion Vulnerability in ninenines Cowboy Web Server

CVE-2026-115701

What is CVE-2026-115701?

The ninenines Cowboy web server is susceptible to a resource exhaustion vulnerability that allows unauthenticated remote attackers to deplete the memory allocated for processing connections over HTTP/1.1. When a request is fully received but the handler is still executing, incoming data on a keep-alive connection is appended to the server's connection buffer without any limits. Consequently, this can lead to out-of-memory conditions on the Erlang Virtual Machine (VM) if an endpoint persists in holding requests open, thus creating a significant risk for server stability and performance.

References